Information Management Assessment

Department for Culture, Media and Sport

Reviewed March 2017

Published January 2018

Working with government to raise standards in information management Statement of commitment

The following statement was provided by the Permanent Secretary of Department for Culture, Media and Sport (DCMS). It is published on GOV.uk.

The Department for Culture, Media and Sport last undertook an Information Management Assessment (IMA) in 2010. This was part of the regular programme of assessments that The National Archives conducts to review information, records and knowledge management standards within government departments. To demonstrate the strength of the department’s commitment I have asked The National Archives to carry out an Information Management reassessment in March 2017.

The Department for Culture, Media and Sport recognises the importance of meeting its corporate obligations to effectively manage, protect and exploit its information. The report that The National Archives produces will help me to support all aspects of knowledge and information management across the department. It will help to make sure that our information, knowledge and records are appropriately captured, managed and preserved, and information risks and sensitivities are suitably handled.

Sue Owen, Permanent Under-Secretary, Department for Culture, Media and Sport

IMA background

The Information Management Assessment (IMA) entailed a detailed review of supporting documentation followed by interviews with senior staff, specialists and practitioners in the department’s London office. These were conducted between 13 – 16 March 2017.

The following report provides a summary of good practice and risks identified. IMA reports and departmental action plans are published on The National Archives’ website at: http://www.nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Executive summary

There are ten performance headings embedded in this IMA report. Department for Culture, Media and Sport (DCMS) achieved one ‘Good’ rating and a further two ‘Satisfactory’ ratings.

The report gives particular recognition to the formation of the Knowledge, Information Management and Information Technology committee, appointment of a new SCS KIM Champion and allocation of permanent Departmental Records Officer (DRO) resource at an appropriate level. DCMS has also developed a Records Management Strategy which sets the direction for the records and information landscape between 2016 and 2020. Also notable is the progress that DCMS has made in starting to tackle its backlog of legacy paper records.

The IMA report identifies seven ‘Development needed’ ratings with which our core recommendations are aligned. Addressing these will help support continued improvement. In particular DCMS should:

- Improve its approach to information risk and information asset management through identifying, documenting and owning information and records management risks and mitigations, increasing support for Information Asset Owners in their role and improving oversight of information assets.
- Promote and maintain a good culture of records management by ensuring that staff have a clear idea of their responsibilities for managing information and records and are encouraged to demonstrate the right behaviours through training, guidance and communications.
- Develop a process for monitoring compliance with information and records management policy.
- Ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible.
- Continue to ensure that the DRO and team are equipped to discharge functions around information and records management and information assurance, in particular any legislative obligations, and ensuring that Knowledge Champions are clear on their responsibilities and supported by management.
- Develop a process for the appraisal, selection, sensitivity review and transfer of digital information and maintain progress in reviewing and transferring paper records in accordance with the Public Records Act and 20-year rule. Good practice areas

The following areas of good practice were identified at the time of the assessment. They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks:

| Highlights of the 2017 IMA | |---------------------------| | Department for Culture, Media and Sport (DCMS) has put in place a governance board: the Knowledge and Information Management and Information Technology (KIMIT) committee. This covers knowledge management, information and records management and IT and includes representatives from these areas and also SCS staff from across the department. This will help to ensure that records management meets the needs of the business and enables joined-up planning and working. KIMIT reports into the Executive Board, providing a route to raise KIM issues to the highest level in the organisation. It was also very encouraging to see that there had been a push around attendance from both the Chair of KIMIT and the Permanent Secretary, highlighting the importance of the committee and instructing senior staff to attend. | | DCMS has made good progress tackling the legacy paper backlog, interrogating the records held (over 60,000) to ascertain how many were in breach of the Public Records Act (22,000) and how many were in scope for the full review process (6000). An agreement has been established with Department for Communities and Local Government (DCLG) to carry out this work for DCMS. There are documented processes and guidance to support this work and measures in place at both the DCLG and DCMS end for quality assurance. DCLG staff have significant knowledge and experience in review and transfer of paper files. DCMS also demonstrated good practice in carrying out research to understand legacy paper files, including interviewing long standing members of staff and has put significant effort into developing policies/tools to inform selection, such as an Operational Selection Policy. A schedule has also been developed outlining DCMS’ projected transfers for future years. As a result of this work DCMS has now transferred its first batch of paper records for some time. | | Blog posts are being used internally to convey the importance of KIM. For example, #SortitShareitSaveit: An Information Management Assessment – for the record!, a blog post from the new Departmental Records Officer about his role, the impending IMA, the work of the Knowledge Champions and information management briefings. | | DCMS has put in place records management and IT strategies, and is about to develop a knowledge strategy. All three strategies are owned by the KIMIT Committee to ensure that strategic goals in these areas are fully aligned. |

## Recommendations to address risk areas

Further detail can be found in Annex A

| Recommendation 1 | |------------------| | Department for Culture, Media and Sport (DCMS) should continue to improve its approach to information risk and information asset management. |

| Recommendation 2 | |------------------| | DCMS should continue work to promote and maintain a good culture of information and records management across the department. |

| Recommendation 3 | |------------------| | DCMS needs to ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible. |

| Recommendation 4 | |------------------| | DCMS should continue to develop and support its KIM team governance and team structures and the service that it provides to the business. |

| Recommendation 5 | |------------------| | DCMS needs to continue to maintain its progress in appraisal and selecting and transferring paper records in accordance with the Public Records Act and 20 Year Rule. |

| Recommendation 6 | |------------------| | DCMS needs to develop a process for the appraisal, selection, transfer and sensitivity review of its digital information. | Key findings of the assessment

1 The value of information

Key developments since the last IMA:

- Senior engagement with information and records management has improved significantly since the last IMA and a new SCS Knowledge and Information Management (KIM) Champion has been appointed.

| Performance rating | |--------------------| | Communicating and realising value | Satisfactory | | Managing information as an asset | Development needed |

- We were pleased to see communications by the Permanent Secretary on the IMA and a personal push on attendance for the Knowledge and Information Management and Information Technology (KIMIT) committee. The KIMIT committee has helped to drive senior engagement in business areas.
- Also encouraging is the appointment of a new SCS level KIM Champion, after a period where the role was covered on an interim basis by the Departmental Records Officer (DRO). The KIM Champion will be working with the DRO to define the Knowledge Strategy.
- A Records Management Strategy has been developed which sets the direction for the records and information landscape between 2016 and 2020. It is good practice that this is owned by KIMIT (alongside the IT and Knowledge Strategies) and will be updated following the IMA to incorporate our recommendations. See highlights table
- We saw evidence of a concerted drive to push the importance of records and information management on the intranet (including blogs) and team leads are taking the opportunity to invite the KIM team to meetings to brief staff on information and records management. See highlights table. It is essential that DCMS continue to promote a positive information and records management culture and keep promoting the KIM message. This is due to the risks around knowledge transfer and record keeping resulting from the constant process of change both within the department and externally. See recommendation 2
- Information Asset Owners (IAO) are not always fully aware of their responsibilities: the staff we interviewed were sometimes unclear on the purpose of the role or who their IAO was. Similarly, we found little evidence that people were aware of the Information Asset Register (IAR) and how it should be used. As a result there is a risk that key information assets will not be properly identified, managed and protected. See recommendation 1
- At the time of the IMA, the DRO was due to attend The National Archives’ IAO Train the Trainer session. DCMS was also starting to look at how it uses its IAR and its approach to information asset management in general, which should also help to address this. See recommendation 1

2 Digital information and supporting technology

Key developments since the last IMA:

- DCMS has adopted a Google platform with Cabinet Office acting as its IT provider.

| Performance rating | Supporting information through technology | Development needed | |--------------------|------------------------------------------|--------------------| | | Digital continuity and IT change | Development needed |

- The move to Google/cloud-based working is raising new opportunities for collaborative and mobile work practices. Some staff had even volunteered to act as Super Users to help colleagues get the best out of working with new technology. However, in its current form the Google environment does not enable full lifecycle management of digital information as set out in the S46 Code of Practice for Records Management. As a result, DCMS risks not being able to effectively manage its digital information or fully comply with information legislation. The rollout of AODocs – a records management bolt-on – will address this in part, enabling greater control over records and more targeted search functionality, although issues around the management of email and the ability to apply retention and disposal will remain. DCMS needs to ensure that its technology environment supports its requirements for digital records management and mitigate the risks where this is not possible. It will need to work closely with IT provider, Cabinet Office, on this. See recommendation 3

- Managing email is particularly problematic in the current environment. The process of getting emails into Google Drive is not easy and involves several steps. Also, emails are saved in a PDF format within Google so cannot be readily reused if required. Staff are not always saving emails of business value into Google Drive and there is a risk of gaps in corporate record keeping. See recommendation 3

- Although the staff we interviewed were often aware of the need to manage records they were not always doing this in a way that enabled such records to be shared and managed appropriately – for example, some used hard drives or personal areas rather than Google drive. To avoid the risk of unmanaged, information silos, DCMS needs to support staff to ensure that they are using the right systems for the right purpose and in the right way; this is achieved through policies, guidance and training. See recommendation 3

- DCMS is currently reviewing the service that Cabinet Office provides, working with Cabinet Office to produce a more detailed breakdown of what it should cover. Requirements around information and records management should form a core part of this work. See recommendation 3

- The DRO does not officially feed into the IT procurement process. The DRO has been involved from a records management perspective in the procurement of the new correspondence management system (IMA 15) and fed into the recent IT Discovery Project. This now needs to happen more consistently as part of the IT procurement process to ensure that tools enable proper records management and compliance with information legislation. See recommendation 3

- Around 80% of legacy digital information was transferred from Livelink to Google. The 20% that remains is held outside Google on a separate server. In order to avoid the risk of information loss, or keeping information longer than necessary, DCMS needs to have a plan in place to establish what it holds. By doing this it can identify information of business and historical value and ensure that this is maintained until the point of disposal. See recommendations 3 and 6

3 Information risk, governance and oversight

| Key developments since the last IMA: | |-------------------------------------| | DCMS has made good progress in establishing a governance structure for KIM. |

| Performance rating | |---------------------| | Recognising information risk | Development needed | | Establishing control | Good practice | | Providing guidance | Development needed | | Measuring Impact | Development needed |

- The KIMIT Committee has responsibility for information risks and for escalating these when required. Information risks defined on the KIMIT risk register are mainly operational in nature. For instance, there is no risk concerning the potential impact on the business of not capturing and keeping information appropriately – both in terms of limitations of Google environment and cultural factors. These risks need to be properly recognised and mitigated. See recommendation 1

- The KIMIT Committee is one of the best examples of governance boards for KIM that we have seen across government. See highlights table

- The DRO has so far been supported by a contractor and a part time member of staff, both of whom will be moving on in the coming months. DCMS needs to ensure that it continues to meet its responsibilities under the Public Records Act when these staff move on. See recommendation 4 • DCMS has a records management policy but this was produced in 2013, prior to the move to Google. The policy must be updated to reflect these changes to ensure that staff properly understand responsibilities for, and requirements around, information and records management in the current technology environment. See recommendation 2

• DCMS has produced practical guidance on information and records management and in particular guidance on ‘what to keep’ in the Google Drive/AO Docs environment. This was refreshed in January 2017 and is published on the intranet. These pages cover use of AO Docs, Gmail and corporate record keeping.

• DCMS has a network of Knowledge Champions who are responsible for information and records management in their business areas and are playing a crucial role in supporting the use of Google Drive for records management and the rollout of AODocs. There are forums for Knowledge Champions to discuss issues and the DRO has brought them together to discuss topics such as the IMA and AODocs.

• Currently, DCMS risks not getting full benefit from the Knowledge Champions network in terms of improving information and records management in the business. Knowledge Champions are not always clear on what their responsibilities are and this needs to be addressed. It is also essential that the importance of these duties is recognised by their line managers, which is not always the case at present. The appointment of the new SCS KIM Champion should help to push this work forward. See recommendation 4

• Training in information and records management is limited at present and largely relates to the use of systems such as AODocs. There is no formal training at induction for instance. As a result, there is a risk of poor records management practice which will have an impact on the ability to carry out business functions and comply with information legislation. See recommendation 2

• At present there is no formal process for measuring the impact of information and records management policies, guidance and training in business areas. DCMS is at risk of not being able to effectively identify and tackle poor records management practice. See recommendation 4

4 Records, review and transfer

| Key developments since the last IMA: | |-------------------------------------| | • A DRO is now in place and DCMS is making good progress in starting to tackle the backlog of legacy paper records. |

| Performance rating | |---------------------| | Oversight of records and selection | Satisfactory | | Implementing disposal decisions | Development needed | • It is positive to see that DCMS has recruited a permanent DRO at an appropriate level. DCMS now needs to ensure that the DRO has the right support in place, otherwise there is a risk that they will not be able to discharge their functions under the Public Records Act, alongside their other duties. See recommendation 4

• DCMS has successfully established an agreement with Department for Communities and Local Government (DCLG) to carry out work on the appraisal, selection, sensitivity review and transfer of paper records and currently this is working well. A retention instrument is in place to provide legal cover for the backlog of records while they are processed. See highlights table

• Should DCMS or DCLG decide that they no longer wish or are no longer able to carry on with this arrangement then DCMS will consider using its off-site storage contractor for this work following a similar model to HM Treasury. See recommendation 5

• DCMS is yet to develop an approach for the appraisal, selection, sensitivity review and transfer of its digital records. It risks building up a backlog of digital records which will, without appropriate intervention, become increasingly vulnerable as time passes. This needs to be addressed, starting with older collections of digital records transferred into Google Drive and key records such as those of the Olympic Delivery Authority (ODA). It was reported that DCMS is working with the Cabinet Office DRO and The National Archives on this. See recommendation 6 Annex A - Recommendations in full

**Recommendation 1**

Department for Culture, Media and Sport (DCMS) should continue to improve its approach to information risk and information asset management.

This would be supported by:

- Identifying risks that reflect the potential impact of not capturing and keeping information appropriately – both in terms of limitations of the Google environment and cultural factors – and risks around the loss of digital continuity and usability of information. Ensure that these are documented and owned at an appropriate level to drive action.
- Learning from departments which have well defined information and records management risks such as Home Office and Ministry of Justice.
- Arranging a board briefing from The National Archives on information assurance and risk to help increase awareness at a senior level.
- Increasing awareness of the Information Asset Owner (IAO) role across the department, among those that hold the IAO role and DCMS staff more generally.
- Ensuring that IAOs are appointed at an appropriate level and have a clear idea of their responsibilities.
- Producing guidance and training to support IAOs in their role and using The National Archives’ ‘Train the Trainer’ materials to help with this.
- Developing an approach to identify and record information assets that is proportionate and enables DCMS to get oversight of these assets, in particular those that are sensitive or of high value.
- Exploring good practice in information asset governance in other government departments such as the Department for Work and Pensions.

**Recommendation 2**

DCMS should continue work to promote and maintain a good culture of information and records management across the department.

This would be supported by:

- Using KIMIT and the Records Management, IT and Knowledge Strategies to drive work on improving information and records management culture. • Updating the records management policy and associated guidance, ensuring that it clearly sets out the responsibilities of staff for managing their information and records within the new IT environment. • Incorporating information and records management as part of the Management Framework to encourage managers to promote and drive good practice. • Working with business areas to ensure that information and records management is included as part of induction for new staff. The Houses of Parliament and Home Office have both produced e-learning courses to introduce staff to their information and records management responsibilities. • Building on the work it is already doing providing training for staff in information and records management. This could include e-learning. • Exploring and adopting cross government toolkit (available on the Knowledge Hub) to improve departmental culture. • Promoting the Knowledge and Information Management (KIM) message to mitigate risks that arise from machinery of government change and changes in personnel. Engaging with new teams to ensure information management requirements are identified from the outset. • Highlighting the importance of information from an historic and business point of view in order for it to resonate with staff. A good example is HM Treasury creating videos for its intranet on the history of its records. • Identifying a means to engage all SCS staff – not just those that are members of the KIMIT.

Recommendation 3

DCMS needs to ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible.

This would be supported by:

• Ensuring that requirements around information and records management form a core part of work to review and define the service provided by Cabinet Office as IT provider. • Working with Cabinet Office and outside companies such as AODocs to address gaps in the Google environment, in particular around retention and disposal and the management of email. • Keeping pace with developments and sharing its own knowledge and experience of the tools as part of the cross-government Google working group. • Supporting staff to ensure that they are using the right systems for the right purpose and in the right way through policies, guidance and training. • Considering methods to discourage the use of hard drives such as size limits or auto deletion after a certain period of time. • Factoring in information and records management requirements as part of the IT procurement process as standard and ensuring that the Departmental Records Officer has a ‘line in’ to this. • Gaining an oversight of systems and applications that are in use and identifying key information and records management risks. • Developing a plan to reduce the legacy digital information from Livelink (both the 80% inside Google and the 20% on the separate server), including establishing what is held, identifying information of business and historical value and considering future migration/transfer. • Clarifying whether information from legacy shared drives was migrated to Google.

Recommendation 4

DCMS should continue to develop and support its KIM team governance and team structures and the service that it provides to the business.

This would be supported by:

• Providing senior management support to the DRO, ensuring that he and his team are equipped to discharge functions around information and records management and information assurance, in particular any legislative obligations (for example, Public Records Act, Data Protection). • Defining the level of service that will be provided from the central KIM team and how key aspects such as outreach, monitoring and driving improvement will be delivered. • Ensuring that all Knowledge Champions are clear on what their responsibilities are and that the importance of these duties is recognised by their line managers. • Considering how best to monitor compliance and raise capability with information and records management out in the business in a way that is proportionate for a relatively small department like DCMS. Consider the approach taken by both HM Treasury and Home Office.

Recommendation 5 DCMS needs to continue to maintain its progress in appraisal and selecting and transferring paper records in accordance with the Public Records Act and 20 Year Rule.

This would be supported by:

- Continuing to allocate appropriate resource for the appraisal, selection, sensitivity review, disposal and transfer of paper records.
- Considering how the process of sensitivity review (including use of FOI exemptions, redaction and closure applications) may need to change as DCLG and DCMS move to review more recent records which are likely to contain more sensitive information.

**Recommendation 6**

DCMS needs to develop a process for the appraisal, selection, transfer and sensitivity review of its digital information.

This would be supported by:

- Surveying the digital information that DCMS holds across all its systems (including age, format and subject matter) in order to build up a complete picture of its digital holdings. Using this to identify records that are at risk or due for digital review and transfer.
- Exploring and trialling methods of digital appraisal and selection (including the use of analytical tools), drawing on advice and guidance from The National Archives and learning from the experience of other government departments in this area, in particular Ministry of Justice and HM Treasury.
- Ensuring that knowledge of DCMS functions and records gathered through the existing paper review process are used to inform digital appraisal where possible.
- Engaging with cross government work around the sensitivity review of digital information (including the use of analytical tools) and considering how these methods can be applied to digital records held at DCMS.
- Working with Cabinet Office and The National Archives on the transfer of significant digital records such as those of the Olympic Delivery Authority.